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Introduction 


In the past 18 months, we have witnessed a major credit and liquidity crisis in the banking 
system as losses from subprime mortgages, structured investment vehicles, and “covenant- 
lite” leveraged loans generated significant knock-on effects worldwide. Major financial 
institutions have taken more than $500 billion in write-offs, and central banks around the globe 
have initiated emergency measures to restore liquidity. CEOs have been replaced at such 
venerable institutions as Citigroup, Merrill Lynch, and UBS. Bear Stearns, a firm once viewed 
as having a conservative approach to risk management, has been the target of a rescue by 
JPMorgan that was driven and to some extent sponsored by the Federal Reserve. Lehman 
Brothers has filed for bankruptcy. Goldman Sachs and Morgan Stanley have changed status 
to become bank holding companies. To the experience of the present crisis we can add our 
memories of many others: the savings and loan crisis in the 1980s, Black Monday in 1987, the 
Russian debt default and the related collapse of Long-Term Capital Management in 1998, the 
dot-com bust of 2000, and the Enron-led merchant-power collapse of 2001. 


Interest in risk tends to come to the fore at times of crisis and then recede as conditions revert 
to normalcy. This rhythm is the outcome of risk being overwhelmingly discussed in terms of its 
downside. But the resounding message of such crises is that risk is always with us, for good 
as well as ill. And as recent events have demonstrated, a grave mistake is made, and a 
promising opportunity missed, in waiting until everybody else has perceived the problem. 


If this tendency is to change, financial and strategic risks must be managed in an integrated 
fashion, with ownership vested at the CEO level. The tools and techniques to make this 
possible are well established. What has been missing in most organizations is a practical 
process that makes such integrated management possible. 


The subjects of this working paper are understanding risk and implementing risk tools. The 
paper is organized into four sections. The first discusses the historical emergence of risk 
management. The second reviews some of the theoretical and market developments that 
allowed financial institutions to transfer risk and examines the enormous impact of these 
developments on the financial sector. A third section on risk in the corporate sector focuses 
on developments in the energy industry to exemplify how risk management can transform the 
fortunes of nonfinancial companies. Finally, the paper sets out a comprehensive framework 


for how institutions can employ a disciplined, strategic risk-return management process. ! 


Another article, “A Primer on Tools and Techniques of Risk Management” (ID# 737072), 
complements this paper and provides a more detailed discussion of some of the basic 


1 This working paper is a revised and updated version of McKinsey Staff Paper No.68 published in 
July 2008. It is not a history of risk, although it covers some important developments. Anyone 
interested in the long history of risk should read Peter L. Bernstein’s entertaining Against the Gods: 
The Remarkable Story of Risk, New York: Wiley, 1996, which remains the most accessible book on 
the subject. Those seeking a deeper understanding of some of the financial theory that underpins 
modern risk management should read Bernstein’s book Capital Ideas: The Improbable Origins of 
Modern Wall Street, New York: Free Press, 1992, in which the author explains the emergence of 
portfolio theory and the capital asset pricing model, among other important innovations. 
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concepts, tools, and techniques of risk management. It is recommended both to beginners, as 
helpful general background, and to seasoned practitioners in a single area of risk 
management, providing context for the more holistic, integrated approach we advocate. 


At one level, this paper is a description of risk management as practiced in the financial sector 
and the presentation of a process to bring that rigor to nonfinancial companies. But the paper 
is also more than that. In the wake of recent events, commercial and investment banks are 
themselves asking whether they have made systematic errors in their approach to risk. For 
many, the answer is yes. Banks certainly apply sophisticated algorithms and develop 
elaborate models in an effort to manage risk effectively. Yet they tend to underestimate the 
importance of robust cultural risk processes, including incentives to encourage good behavior 
among key business managers and top management. 


As such, there is much in the paper, and in the last section in particular, that should be as 
useful to financial as to nonfinancial institutions. 
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The emergence of modern risk management 


Before the 1970s, risk management in most corporations was largely defined by the 
purchasing of insurance — a strategy to manage downside risk, with no attention paid to 
upside. Risk management was also rudimentary in the financial sector. Bank regulators 
lacked broadly applicable tools for measuring risk in the system, making constructive 
intervention difficult. Banks themselves lacked the tools to shape the interest-rate risks in their 
loan portfolios, and so could do little to protect themselves from swings in interest rates. They 
also lacked tools for quantifying and managing credit risk, and had only the most elementary 
understanding of operational risk. 


In the university setting, however, some important theoretical foundations had already begun 
to be laid. From the 1940s onward, academics started to advance their understanding of risk- 
return trade-offs in investment management and to develop tools to apply their findings (some 
of which are included in Exhibit 1 and Table 1). 


Exhibit 1 


Foundations of modern risk management 


Theory ° Analytic economics + CAPM * Black-Scholes * Under- * Value of 
(Samuelson) (Sharpe) * Arbitrage pricing investment hedging 
9 * Mean variance theory (Ross) problem (Froot, 
S (Markowitz) * Binomial options (Mayers, Scharfstein, 
£ * State preference (Cox and Ross) Smith and and Stein) 
= theory (Arrow) Stulz) 
$ - Modigliani-Miller 
= Tools * Business * Monte Carlo *VaR/RAROC  *Stress testing 
S minicomputer in business * Monte Carlo * RiskMetrics 
ul (PDP-8) * VisiCalc spreadsheet * CreditMetrics 
add-ins 
1940s 1990s and 
and 1950s 1960s 1970s 1980s beyond 
en 
= 
£ | Theory * Game theory * Decision * Chaos theory 
e (Neumann) analysis (Yorke) 
E e Systems dynamics + Nash * Prospect theory / 
= (Forrester) equilibrium Cognitive biases 
£ * Bounded rationality (Kahneman and 
Š (Simon) Tversky) 
S Tools -+ Brainstorming * Decision * Scenario * Genetic * Real options 
"€ (Osborn) trees (Hunt) planning algorithms/Al — * Data mining 
9 e Delphi method +» SWOT (Godet) * Information 
a (RAND) model markets 


Sources: Peter Bernstein, Capital Ideas; Philippe Jorion, Value at Risk; Derivatives Quarterly; McKinsey analysis 


McKinsey&Company 


Table 1 


Important theories and their application 


Name 


Essence of theory 


Relevance 


Allocation efficiency, state 
preference theory (Kenneth 
Arrow, Gerard Debreu) 


Demonstrates that an 
efficient allocation of 
resources and risks requires 
a “complete” set of securities 
that permits agents to hedge 
all risks, thus laying the 
groundwork for general 
equilibrium theory 


Underpins derivatives 
markets, explains decision 
making under uncertainty, 
and shows that the ultimate 
role of securities markets is 
the efficient allocation of risk 
across society 


Mean-variance (Harry 
Markowitz) 


Investors choosing portfolios 
should consider the risks as 
well as the making 
investment choices 


Efficient frontier concept for 
returns from their choices 


Capital asset pricing 
model, or CAPM (Bill 
Sharpe) 


Subject to some limitations, 
markets compensate firms for 
systematic (or market) risk 
but do not discount for 
idiosyncratic risks, which 
investors can diversify 


Directly relevant to discussion 
about whether a firm should 
hedge its idiosyncratic risks 
or leave them alone because 
the market will not reward it 
for mitigating them 


Capital structure (Franco 
Modigliani, Merton Miller) 


Subject to strong constraints 
(e.g., no taxes), a firm's 
capital structure makes no 
difference to its valuation by 
the market because the 
overall riskiness of the firm is 
the same 


When constraints are 
removed, the model breaks 
down, introducing the idea of 
efficient capital structure and 
the role of risk mitigation 
through hedging 


Options pricing (Fischer 
Black, Myron Scholes, Robert 
Merton) 


Volatility is the key to 
consistent pricing of options 


The concept of real options 
essentially allows companies 
to put a value on waiting 


Binomial options pricing 
(John Cox, Stephen Ross, 
Mark Rubinstein) 


Models the underlying 
instrument over time, as 
opposed to at a particular 
point, increasing accuracy, 
particularly for longer-dated 
options 


Allows better pricing of 
options that contain greater 
flexibility 


Arbitrage pricing theory 
(Stephen Ross) 


Less restrictive alternative to 
CAPM, defines the expected 
return of a financial asset as 
a linear function of various 
macroeconomic factors or 
theoretical market indices 


Allows investors to segment 
CAPM'’s systematic risk into 
factors or components that 
influence correlations 


McKinsey&Company 


This research began filtering into the business community in the early 1970s via two seminal 
developments: the publication of the option pricing model by Fischer Black and Myron Scholes 
(along with its independent confirmation and enhancement by Robert Merton), and the 
introduction of Bill Sharpe’s capital asset pricing model (CAPM).2 These contributions marked 
the beginning of modern risk management: the moment at which risk could start to be 
effectively priced and mitigated. Suddenly, what had existed as latent demand materialized 
into a need — a need suddenly made more urgent by the end of the Bretton Woods exchange- 


rate regime and the OPEC oil shock.3 


The core concept addressed by Black and Scholes was optionality. Embedded in all financial 
instruments, capital structures, and business portfolios are options that can expire worthless, 
or be exercised or sold. In many cases, an option is both obvious and bounded, such as an 
option to buy GE stock at a given price for a given period. In other cases, options are subtler. 
In their original publication, Black and Scholes observed that the holders of equity in a firm 
with debt in its capital structure have an option to buy back the firm from the debt holders at a 
strike price equal to the firm’s debt. Similarly, the still-emerging field of “real options” identifies 
options implicit in a firm’s operations — for example, the option to cancel or defer a project 
based on information from a pilot. The theory of real options puts a value on managerial 
flexibility — a factor overlooked in straightforward net-present-value (NPV) calculations, which 


assume an all-or-nothing attitude to a project.4 


Sharpe’s model, the CAPM, suggests that a company’s shares bundle two types of risk. Only 
one of these, systematic risk, is compensated by the market. Systematic risk is measured by 
the firm’s “beta,” which reflects the stock’s correlation with the overall market. Sharpe argued 
that beta is the sole differentiator of the cost of equity across corporations. The other type of 
risk, known as nonsystematic or idiosyncratic risk, is unique to the company. Sharpe 
demonstrated that these risks should not affect the company's cost of capital because 
investors can hold other shares and investments that diversify away this exposure. 


Ironically, given the intellectual achievements Black-Scholes and CAPM represent, the third 
important risk-related development in the 1970s was probably the emergence of the handheld 
electronic calculator familiar to a particular generation of schoolchildren. Texas Instruments 
marketed its new product with the tag line "Now you can find the Black-Scholes value using 


our... calculator.” The rapid acceptance of this calculator by options traders cemented the 
arrival of derivatives and the broad development of standard pricing models. In 1975, the first 
personal computers were launched. In 1979, Dan Bricklin and Bob Frankston released 
VisiCalc, the first spreadsheet designed to work on a PC. This gave managers a simple tool 
for running “what if" scenarios. Financial instruments for managing different types of risk were 
rapidly developed and trading was begun both on exchanges and in emerging over-the- 
counter (OTC) derivative markets. 


2 Other researchers, notably Jack Treynor, arrived independently at some of Sharpe’s conclusions, 
but Sharpe was the first and his name is associated with CAPM. 


J tis worth noting that the combined phenomenon of high oil prices, general volatility in the market, 
exchange-rate volatility, and inflation is with us again in 2008. 


^ See the companion piece to this paper, “A Primer on Tools and Techniques of Risk Management 
(ID# 737072), for a fuller exploration of this idea. 


5 Bernstein, Against the Gods, p. 316. 


” 
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By the 1980s, greater computing power was inexorably adding calculating muscle directly to 
trading desks, allowing complex calculations to be run ever faster and pricing to move closer 
to real time. Among the most influential machines were the workstations developed by Sun 
and DEC and the Bloomberg terminal, which revolutionized price calculation in derivatives and 
fixed-income markets respectively. Software developed by companies such as Crystal Ball 
allowed traders to run Monte Carlo simulations — complex calculating processes that 
undertake thousands of iterations to produce distributions of outcomes — in a matter of minutes 
on laptops, rather than overnight on mainframe computers. The upshot was an 
unprecedented growth in liquidity and the integrity of pricing. 


As Exhibit 2 suggests, these innovations enabled a revolution in financial services that 
included the emergence of stock options, foreign-exchange futures, interest-rate swaps, 
commodity futures, index swaps, credit derivatives, and even more sophisticated instruments. 
The market for OTC derivatives grew fourfold from 1998 to 2006. All in all, the notion of credit 
was essentially reinvented, as entire markets and enormous business opportunities developed 
around concepts that had hitherto been inseparable from the underlying assets being traded. 
The market has since become so sophisticated that synthetic collateralized debt obligations 


Exhibit 2 


Risk innovations set off a revolution in the financial services industry 


Explosion of risk-transfer markets 


* Foreign-exchange futures, stock options 


* Interest-rate swaps 
U uj) -S&P 100 options 


Reinvention of credit 

* Disaggregation of origination, credit risk, 
and interest-rate risk 

* Creation of markets — e.g., credit default 


* NYMEX oil futures 


* Equity index swaps, catastrophe options, 
collateralized debt options (CDOs), credit 
derivatives, swaptions, electricity futures, 
over-the-counter (OTC) weather futures, 
macroeconomic derivatives 


swaps, CDOs, mortgage-backed 
securities 

* Reduction of costs, credit spreads, and 
exposures to interest rates/credit 


Mid 1998 


Notional OTC derivatives 
$ Trillions 


+728% 


596 “| 56 currency 
58 credit 
Oth 
e $ 85 equity 
-.| 9 commodity 
Interest 


rate 


End 2007 


Sources: U.S. Treasury, BIS 


New business opportunities 

* Hedge funds (increased by $1 trillion in 
the past decade) 

* Private equity 

* Commodity traders 

* Derivatives market makers 


McKinsey&Company 


(CDOs), or derivatives of derivatives of derivatives, are now being sold — and were in fact the 
fastest-growing part of the multitrillion-dollar CDO market until the credit crunch of late 2007.6 


Stimulated by these developments, a new generation of academics’ looked at the case for risk 
mitigation and confirmed that it could indeed create shareholder value in three main ways: by 
reducing the probability and expected costs of financial distress, by enabling a more suitable 
level of debt and thereby reducing a firm’s income taxes and financing costs, and by mitigating 
agency costs and preserving management's ability and incentives to carry out profitable 
investments. These conclusions gave validity to the growing field of risk management and 
provided a counterbalance to the indifference theory, articulated by Modigliani, Miller, and 
others, that had schooled generations of MBAs to think that capital structure and hedging had 
minimal impact on a company’s cost of capital and value. Wall Street and its clients, of course, 
had already embraced financial engineering — largely relegating the indifference theory debate 
to academia. 


Risk in the financial sector 


Innovations in risk management 


Many of the important innovations in risk management originated in the banking and securities 
industries, for three reasons. First, financial institutions are effectively risk-intermediation 
businesses. Many of the more sophisticated players (generally securities houses and 
investment banks) realized that their ability to describe and manage risk was a core 
competence, and they were the earliest non-academic institutions to think systematically about 
risk. 


Second, as Peter Bernstein pointed out, financial industries are rich in data and so were able, 
early on, to quantify risk using new technologies. Third, because banks were dealing with 
citizens’ money, they were pushed by regulators to consider the potential impact of failure and 
to improve their risk-management capabilities. The fear of financial-institution failure went 
back to the Herstatt Bank collapse in 1974. Herstatt, a German bank, failed, and many 
international banks were badly hurt because of the time lag related to cross-border settlements 


during that period.8 


Today, risk management in banking is a core function, and virtually all banks have chief risk 
officers. But many of the advances we now take for granted are in fact relatively recent. In the 


6 It remains to be seen how the recent drying up of liquidity in the markets will unfold. But even a 
backlash against the complexity of some structured instruments would be unlikely to cause a retreat 
from the underlying technology, i.e., the ability to slice and repackage risks. 

7 Examples include work on the underinvestment problem by David Mayers, Clifford W. Smith, René 
M. Stulz, and on the value of hedging by Kenneth A. Froot, David S. Sharfstein, Jeremy C. Stein. 

8 Essentially, foreign-exchange transactions executed in Germany before the bank was declared 
insolvent had not cleared in New York because the markets there were not yet open, leaving 
enormous exposures. This was one of the big “wake-up” events of modern risk management. It 
ultimately took nearly 20 years to solve what became known as Herstatt risk. 
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early 1990s, the American banking system faced severe difficulties. Citibank was in danger of 
collapse and was rescued by a Saudi prince, who came to own the equivalent of 15 percent of 
the company’s equity.9 Other banks, including Bank of New England, did go under. At root, 
poor risk management was to blame. Banks had only a limited understanding of the credit 
risks in their loan portfolios, typically had mismatched assets and liabilities, and retained loss- 
making exposures on their balance sheets. A typical bank took deposits and originated loans. 
But the deposits were of shorter duration than the loans, which meant that a sharp rise in 
interest rates could immediately jeopardize a bank's financial health. 


In the early 1990s, most commercial banks lacked now-commonplace tools such as value at 
risk, risk-adjusted return on capital, economic capital, risk-adjusted regulatory capital, credit- 
risk models, and enterprise risk management.!9 By contrast, securities firms and investment 
banks had become quite sophisticated in their use of risk management. They realized that 
many traditional commercial banking activities could benefit from techniques similar to those 
used for trading shares and bonds. Bank loans could be "marked to market" — priced as if they 
had to be sold that day, even though they might not mature for years to come — turned into 
securities, and traded. Portfolios of loans could be packaged into tranches bearing different 
levels of risk, interest-rate risk could be separated from credit risk, and so on. 


Partly because securities firms and investment banks were skilled in packaging and trading, 
and because commercial banks had capital and credit-origination skills, a wave of mergers 
began until the distinctions blurred and became less relevant. Over a 20-year period 
beginning in the mid-1980s, the financial sector became a gigantic risk clearinghouse. It 
remains a work in progress. For instance, the convergence of capital markets and insurance, 
essential for the development of new risk-transfer mechanisms and structured risk- 
management solutions, is not yet complete but is well under way — as evidenced by the market 
for catastrophe bonds. 


The impact of risk transfer markets 


In a risk-transfer market, contracts are exchanged that allow a specified risk or bundle of risks 
to change hands. Risk-transfer markets have been major enablers of dramatic growth in four 
key segments — mortgages, wholesale credit, alternative risk transfer (ART), and hedge 
funds/private equity. 


1. Mortgages 


Clearly, the current crisis was propelled by financial institutions' failure to understand certain 
mortgage-derived instruments. Yet overall, the market for mortgage-based securities remains 
the most readily understood example of how risk instruments can transform the scope and 
nature of a business. The mortgage market has grown from a retail-finance backwater, in 
which banks originated and held their mortgages as a single portfolio, into one of the largest 
and most innovative sectors of the financial industry, particularly in the U.S. (Exhibit 3). Many 


9 Interestingly, Prince Alwaleed bin Talal stepped in with a Citigroup equity purchase in 2008. 


10. See “A Primer on Tools and Techniques of Risk Management" (ID#737072) for a fuller description of 
VaR, RAROC, and credit-risk models. 
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of the tools of modern risk management have been embraced, from securitization (the pooling 
of loans that are then sliced into tranches to create different risk-bearing structures that can be 
sold) to the creation of new products that explicitly recognize the optionality built into long-term 
products such as the 30-year mortgage (the most obvious option being to repay early). 


Exhibit 3 
Risk innovations set off a revolution in the financial services industry: 


mortgage-backed securities issuance 


Mortgage-backed securities issuance 1988-2007* 


$ Billions 2,716 


2,156 


2,045 
1,857 1,883 1,865 


1988 89 1990 91 92 93 94 1995 96 97 98 99 2000 01 02 03 04 2005 06 2007 


* Includes Ginnie Mae, Fannie Mae; Freddie Mac and Non-agency 
Source: Inside Mortgage Finance MBS database; Ginnie Mae; Fannie Mae; Freddie Mac 


The effects on the banking industry have been profound. Growth coupled with more effective 
risk management led to unprecedented profitability. Derivatives and pass-through 
mechanisms that transfer elements of risk in a pool of mortgages allowed mortgage originators 
to avoid taking interest-rate or credit risk, removing a major hazard from their portfolios and 
encouraging further origination, which expanded the market and drove demand for mortgage 
products. 


As we have now been reminded, the ability to transfer risk does not lead automatically to the 
elimination of risk. In some circumstances, it merely moves the risk elsewhere. By mid-2007, 
it had become apparent that the underwriting associated with the subprime segment of the 
U.S. mortgage market had become far too lax, and a major financial crisis ensued. Rising 
default rates and falling house prices quickly had an effect on pricing, first on the lower-rated 
tranches of mortgage securitizations and then on more senior tranches. In turn, declining 
confidence led to a general withdrawal of liquidity from the banking system and a consequent 
reduction of available credit. Many mortgage institutions failed or were sold. Some of the 
world’s biggest banks wrote off billions of dollars and fired some of their top managers. Most 
famously, in an emergency deal Bear Stearns was sold to JPMorgan for a fraction of its traded 
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value. Lehman Brothers filed for bankruptcy. Fannie Mae and Freddie Mac were nationalized. 
The so-called “credit crunch” changed the policy landscape for central banks, creating 
pressure for interest-rate cuts and special lending facilities for liquidity-starved banks and 


securities firms.11 


2. Wholesale credit markets 


A similar transformation has swept the wholesale credit markets, or the markets for large 
corporate loans made by commercial banks. 


Roughly speaking, the risk profile of a typical commercial bank breaks down into 60 percent 
credit risk, 20 percent market risk, and 20 percent operational risk. The past 35 years have 
seen a sharp rise in a bank’s ability to mitigate these risks. The growth in credit derivatives, 
greater depth and liquidity in the secondary market for corporate loans, and securitization have 
transformed the management of credit risk by hugely expanding the scope for risk transfer. 


Increasingly, banks can refine their portfolios to retain only those risks in which they have a 
competitive advantage (i.e., those risks of which they are the “natural owner”). They use credit 
portfolio management techniques to decide which combinations of risks to retain. For 
example, although they might retain exposure to a corporate customer, they can use credit 
default swaps — derivative instruments that protect against a given company experiencing 
financial distress — to mitigate that exposure. They can also use index products to raise or 
lower their overall exposure to credit as an asset class, depending on whether they believe 
credit to be too cheap or too expensive. Who buys the assets that an individual bank decides 
to shed? To some extent, other banks with offsetting risks of their own. The main buyers, 
however, are pension and hedge funds, insurers, and other alternative investors seeking 
assets not directly correlated with stock and bond markets. 


During the past year, it became evident that some instruments, although theoretically sound, 
were difficult to manage in practice. In particular, vehicles that pool loans together and then 
repackage them, as well as derivatives of the pools themselves, are highly complex. Banks 
have discovered the hard way that credit risks thought to be independent often subtly interact. 


3. Insurance and alternative risk transfer (ART) 


There is a great deal of literature on the evolution of the insurance and reinsurance 


industries.12 Insurance concepts have been and remain of enormous influence the 
development of risk-transfer products and markets. As with other areas, however, this field is 
seen by many as forbiddingly technical and not clearly connected to risk management. 


The crisis does not invalidate the importance or influence of the ability to slice risks into discrete 
elements, although it does reinforce the fact that even the largest markets depend on the quality of 
the underlying assets and the continued supply of liquidity. 


12. Some of the best summaries can be found in sigma, published by Swiss Re and available on its 
Web site. The richest single source is Christopher L. Culp, Structured Finance and Insurance: The 
ART of Managing Capital and Risk, New York: Wiley, 2006. 
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ART is simply the creation of a risk-transfer solution that combines capital markets and 
insurance such that some of the insurable risks are transferred to non-insurers.!? Consider a 
company that is trying to understand its risk capacity. A simple starting point is to ask how 
much risk the company wants to insure and how much it wishes to retain as direct exposure — 
effectively, to self-insure. 14 


One well-known deal that demonstrates the power of these concepts dates to late 2000, when 
Swiss Re and Société Générale developed an innovative facility for Compagnie Financiére 
Michelin, the Swiss holding company of the French tire maker. At the heart of the transaction 
was what is called contingent capital, which gives a company the right to issue new debt, 
equity, or some structured securities at a predefined price during a set period of time. In 
effect, the company buys the option to issue securities in the future, subject to the trigger (or 
triggers) of an unwanted outcome or loss arising from the risks specified in the terms of the 
deal. Michelin wanted to lock in the option of raising capital in the event that the world’s largest 
economies suffered a slowdown, causing its earnings to fall. 


There are many other examples involving financing structures that package options in the form 
of insurance contracts. This is an area of ongoing innovation. 


4. Financial services industry: hedge funds and private equity 


As soon as the kinds of instruments discussed here became available, professional investors 
wanted to take advantage of them to separate and transfer many different kinds of risks in 
order to optimize their risk exposures. But traditional funds, being open to the general public, 
were regulated for the public’s protection — the public having appropriately been deemed 
lacking in the knowledge required to engage in elaborate risk-transfer mechanisms. Enter 
hedge funds, investment pools neither subject to the Investment Company Act of 1940 nor 
governed as mutual funds, and open only to high-net-worth and institutional investors. Hedge 
funds have rapidly evolved to allow investors to be extremely precise about the kinds of 
exposure they seek across different asset classes, time horizons, and so on. In addition, they 
have become important providers of liquidity to the banking system through their role as 
investors in a range of asset-backed securities. 


Hedge funds are not without controversy. Do they really control the risks they run, or are they 
vulnerable to liquidity shocks and gaming by their competitors — concerns that recent events 
have sharpened? Does the leverage they use to boost their returns introduce new risks into 


13 [tis widely accepted that there is an ongoing convergence between insurance and capital markets, 
but, as Culp has argued, "even the most similar concepts in the two worlds are often not recognized 
as being essentially the same thing" (Structured Finance and Insurance, p. xv). Culp makes an 
important distinction between structured finance — the use of nontraditional financing methods to lay 
off risk that cannot be dealt with in conventional markets — and structured insurance (which includes, 
but is not limited to, ART), or the use of nontraditional risk-finance and risk-transfer techniques to 
manage risk in a way that also affects the firm's capital structure and/or weighted average cost of 
capital. 


Over the past 20 years, many large companies embraced self-insurance, setting up "captive" 
vehicles that essentially took insurance in-house on the basis that meeting any losses would be 
cheaper than buying insurance in the market. But the underlying motive was often tax rather than 
risk efficiency. Captives have been effective but are also controversial. Critics argue that they 
create new risks by removing third-party monitoring (in the form of an insurer). 
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financial markets? These questions surfaced after the high-profile failure of Long-Term 
Capital Management in 1998-2000, and again when Amaranth lost billions of dollars on natural 
gas futures contracts in 2006, and most recently when the Federal Reserve underwrote 
JPMorgan’s purchase of Bear Stearns. Despite these concerns, however, the sector has been 
dynamic and has grown strongly, even through the market fluctuations of late 2007-early 2008 
(Exhibit 4). 


Exhibit 4 


Risk innovations set off a revolution in the financial services industry: 
private equity and hedge funds 


Private equity and hedge funds - global assets under management* 


$ Billions 
2,786 
918 Private equit 
2,132 abd 
667 
1,570 
1,360 
1,207 465 
1,044 387 
831 935 418 E 1,868} Hedge funds 
E 700 349 | | 396 1,465 
204| | 244 973 S 
" 820 
375| |456| | 491] | 839) | °° 


1998 1999 2000 2001 2002 2003 2004 2005 2006 2007 
* Hedge fund: all assets under management at the time; Private equity: sum of all buyout AUM raised over previous 5 
Source: HFR, PE Intelligence 


Private equity has proved equally dynamic. Private equity firms purchase companies and then 
restructure them to focus on the risks the company naturally owns. As with hedge funds, what 
was once a marginal activity became a mainstream one. Aggressive, capital-rich private 
equity firms stalked the world’s capital markets looking for opportunities to make profits by 
taking listed companies into private ownership. By adding leverage through the assumption of 
debt and by shaping each company’s risk exposure, private-equity buyers increase the odds of 
a large payoff. In 2007 we witnessed a string of large deals, culminating in the $45 billion 
buyout of TXU (see the case study of this important example of a leading-edge nonfinancial 
company’s management of risk in the sidebar below). 


Although not often described in the language of risk management, as most private equity firms 
stress their financial and management skills, private equity can be seen as a cutting-edge 
application of risk-management techniques. Many private equity deals utilize complex 
structured-finance tools that capitalize on risk markets to provide a lower cost of capital 
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through debt and hedging than would have been available through the traditional use of public 
equity. 15 


Goldman Sachs and the culture of risk 


Goldman Sachs, generally recognized as the world’s leading investment banking, securities, 
and investment management firm, exploits risk to achieve attractive returns in a prudent 
fashion. The results have been formidable. During the financial turmoil of 2007-08, Goldman 
notably avoided the large losses that afflicted its main competitors, perhaps the strongest 
evidence yet that its risk-based culture creates superior performance. But there was a strong 
case before this that the bank had taken risk management to a new level. In 2006, Goldman 
set aside a total of $16.5 billion for salaries, bonuses, and benefits, or an average of $622,000 
for each of its 26,000 employees. Goldman obtained 68 percent of its net revenues from 
trading and principal investments, including a substantial amount from gains earned trading on 
its own account. Only 17 percent of net revenues came from the traditional investment 
banking and advisory business for which it was once best known. 


. 2002 2004 Ml 2006 
Goldman Sachs risks money to make money 2003 B] 2005 ME 2007 


Negative trading days 


China and the intemet 


ECONOMIST ebusiness otAmerican footbal 


Marijuana as a useful medicine 


Th e George Bush's problem with petrol ol man 52 
achs 40 


- LA's troubled schools 


Morgan Stanley 


“People who have left Goldman say that its [risk management] is unmatched at rivals. One 
consequence is that Goldman seems confident that it can take more risks than its competitors 
do. Its trading revenues are the most volatile among big investment banks and it has the most 
days when it loses money. Overall, however, it makes the most money.” 


Sources: The Economist 2006, Moody’s; SNL Financial 


15 It remains unclear how far the private-equity model will suffer from reduced liquidity. By early 2008, 
wider credit spreads and stiffer covenants had essentially halted the momentum of large buyouts. 
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Intriguingly, these results — and 2006, albeit the best, was one of many good years — were built 
on the back of a firm with trading revenues more volatile than those of all its peers. Goldman 
has the most days when it loses money, with a daily trading value at risk (measured at the 
95% confidence level) that increased from less than $50 million in 2002 to more than $100 
million today. In short, Goldman makes money by being willing to lose it. When securities 
markets become more volatile, options rise in value; naturally, the value of experienced risk 
management rises also. Goldman ensures that its managers are familiar and comfortable with 
risk, can debate it freely without fear of sanctions, and are willing to take decisions quickly 
when necessary. The company’s aggressive hedging in 2007 in the markets related to 
subprime mortgages was a striking example of this. Goldman was both skillful and lucky. It 
was skillful in sensing that trouble was brewing and deciding to move quickly to reposition 
itself. It was lucky in getting both the decision and the timing correct on that bet. 


Creating a culture so contrary to people’s instincts and fears is not easy. In our view 
Goldman’s success stems from four factors. None is unique to the firm, but Goldman has 
deployed them all very effectively: 


Partnership heritage. Goldman was funded largely by its own partners from its origins in 
1869 to its IPO in 1999. While other private investment banks distributed more than 80 percent 
of their earnings annually, Goldman partners traditionally left as much as 80 percent of their 
earnings with the firm, withdrawing significant capital only at the end of their careers. Partners 
acted as careful stewards of the firm’s capital because it was their own. This partnership 
heritage continues to inform the interactions of the most senior people within the firm, aided by 
the substantial portion of equity still owned by employees. 


Risk and quantitative professionals. Beginning early in the 1980s, Goldman began to 
invest in distinctive risk professionals and “quants.” Most notable was Fischer Black, of Black- 
Scholes fame, who was brought over from MIT by Robert Rubin in 1984. He led the firm’s 
Quantitative Strategies Group, working on topics ranging from modeling interest-rate 
movements to valuing fixed-income options to modern portfolio management. Other quants 
and risk professionals at Goldman have included Emanuel Derman, a Ph.D. in physics who 
headed the Quantitative Strategies Group after Black, and Bob Litterman, a Ph.D. in 
economics and co-developer of the Black-Litterman global asset allocation model. These 
people brought an early quantitative and intellectual rigor that gave Goldman the basic risk 
skills to manage its complex trading and derivatives businesses. 


Risk oversight, organization, and processes. In 1994, when a sudden unexpected rise in 
global interest rates caused severe losses on many bond trading desks, the firm's large 
proprietary positions led to a substantial decline in profitability and a crisis in morale. In 
response, Jon Corzine restructured Goldman's risk control systems, establishing a firmwide 
risk committee to oversee market and credit risk. The committee meets weekly with the goal 
of ensuring that certain risk-return standards are being applied consistently across the firm 
worldwide. It follows that risks are carefully reported. Daily reports detail the firm's exposures, 
with top sheets showing the potential impact of movements in various macroeconomic risk 
factors; stress tests showing potential losses under a variety of scenarios (e.g., a stock market 
crash on the order of October 1987, a credit spread widening of the kind that occurred in 
autumn 1988, a bond market sell-off as seen in 1994); and replicating portfolios (e.g., what 
portfolio of a limited number of securities would most closely replicate the firm's overall 
position?). Some Goldman executives claim they can estimate the firm's daily P&L simply 
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based on these risk reports and market movements that day. Other kinds of risk are taken 
equally seriously. Operational and reputational risks are addressed by the business practices 
committee, loan and underwriting risks are addressed by its firmwide capital and commitments 
committees, and liquidity risk is managed by the finance committee. 


Values and business principles. Finally, Goldman’s values, as embodied in the firm’s 14 
business principles, reinforce many of these risk-management lessons. The firm’s reputation is 
prized most of all. Individuals who join Goldman are quickly taught that, while no one person 
will make the firm a success, anyone can do enormous damage to the firm’s reputation. When 
potentially controversial choices arise, individuals are encouraged to “escalate, escalate, 
escalate,” drawing in independent views from risk, compliance, legal, and other powerful 
control functions. The fastest way to lose a position at Goldman is not to lose money but to 
make a decision that endangers the reputation of the firm without consulting others. 


wok k 


This is not to say that Goldman is immune from getting things wrong. But were the firm to 
stumble, it would not be for lack of a powerful, risk-informed culture that combines intelligence, 
discipline, and common sense. In that respect, Goldman is a model for all firms. 


Risk for nonfinancial companies 


Risk management does not mean always getting things right. It means getting them less 
wrong, less often, with less damaging consequences. This is most obvious in a financial 
company making buy and sell decisions in liquid markets for traded instruments. Itis less 
obvious but often more significant in an industrial company wondering whether to invest in a 
multibillion-dollar project that will take 5 to 10 years to complete and another 10 to 15 to show 
a profit. 


Indeed, risk management is only now beginning to emerge as a corporate priority in large 
nonfinancial companies. Although more than 80 percent of industrial corporations hedge 
using derivatives, most do so only in the context of currency and interest-rate trades made by 
their treasury departments (Exhibit 5). While most nonfinancial companies assess risk-and- 
return trade-offs qualitatively when making strategic decisions, few have properly developed 
risk-adjusted hurdle rates or risk-adjusted performance standards across business units. And 
few adequately value their risks based on quantitative models or traded risk markets. As a 
result, these companies generally lag far behind the financial players that treat strengthening 
risk capabilities as a core strategic priority. 
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Exhibit 5 


Most nonfinancial companies have been slow to embrace modern 
risk-management tools 


Use only basic risk products 


Products used to manage risk 
% using products 


Insurance 83 
Foreign-exchange derivatives 82 


Interest-rate derivatives 79 


Commodity derivatives 32 


Structured products 13 
Equity derivatives 12 


Credit derivatives 12 


Use risk tools only modestly 


Tools used by risk group Tools used in strategic planning 
% using products % using product 
Value at risk 45 Scenario analysis 46 
Cash flow at risk 43 || Quantify risks 35 
in any way 
Earnings at risk 36 Simulation analysis 26 


Source: Deutsche Bank/GARP Corporate CFO survey of 232 CFOs in 39 countries (2005) 


Examples abound of poorly understood strategic risks faced by nonfinancial companies. How 
might demand for a product change depending on a competitor’s behavior, or slow if China’s 
economy were to deteriorate? Are there unrecognized reputational risks inherent in a course 
of action? What is the probability distribution of a cost or time overrun on a project? What are 
the implications of keeping a particular supply chain tighter or looser than it is today? How will 
the company be affected by a rise in oil prices, an increase in interest rates, or a dramatic 
change in the dollar? 


Faced daily with such questions, nonfinancial firms that lack strong risk processes tend to 
gravitate toward one of two extremes. At one end of the spectrum, they overspend their risk 
capacity, and, if problems occur and credit sources dry up, slash important cash outflows — 
and in some instances even experience difficulty meeting debt obligations. Far more common, 
at the opposite end, corporations hold excess risk capacity — often in order to maintain an 
arbitrary target credit rating. These companies typically maintain capital structures with little or 
no debt and excess cash, a funding strategy that can raise a company’s cost of capital and 
lower its value by as much as 10 to 15 percent.16 They also often employ risk-averse decision 
processes such as inflated investment hurdle rates or conservative price and margin forecasts 


16 The 10 to 15 percent value impact reflects a foregone interest tax shield applied to a potential 30 to 
40 percent debt level as against a 0 percent debt level (net of cash) and assumes a 35 percent tax 
rate. 
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to ration investment capital, choking off value-creating growth opportunities. In some cases, 
they go further by hedging interest-rate, currency, or commodity exposures. 


The beginning of good risk management is to embrace sophisticated financial firms’ 
fundamental attitude to risk: risk is neither good nor bad; individual risks are good or bad for 
your company. Once a management team has made this shift in mindset, it can begin to 
position the company to benefit from risk by implementing appropriate controls and protocols. 


What should these controls and protocols look like for a typical nonfinancial firm? A good 
model is the energy industry, whose players have been in the vanguard among nonfinancial 
firms with regard to their active management of risk. 


Risk in the energy sector 


The energy sector embraced risk-management techniques earlier and more thoroughly than 
other corporate sectors, for three principal reasons. 


First, energy companies face substantial commodity risk: oil and natural gas producers 
experience prices that are typically much more volatile than interest rates, credit spreads, and 
exchange rates. Energy processors such as oil refiners face even greater volatility than 
producers because they are exposed to fluctuations in prices for refined products as well as 
those for crude oil. Deregulated power generators, which produce electricity - a commodity 
that cannot be stored and so must be sold the moment it is produced — face the greatest 
volatility of all. 


Second, energy companies must make very large investment commitments (a single refinery, 
offshore oil platform, or power plant costs several billion dollars) involving time horizons of 30 
to 50 years, covering multiple industry cycles and technological discontinuities. 


Third, enabled by the creation of spot physical markets for most energy commodities, the 
energy industry has undergone a dramatic unbundling, as the vertically integrated market of 
30 years ago has given way to a world of independent gas producers, independent refiners, 
and merchant power generators. 


Given this context, the rapid growth of energy futures markets such as the New York 
Mercantile Exchange (NYMEX) and the IntercontinentalExchange (ICE), as well as OTC 
derivative markets, is not surprising. In the 1990s, major oil companies (e.g., BP, Shell), large 
electric utilities (e.g., Duke Energy, Sempra, RWE, Southern), and leading natural gas 
companies (e.g., Dynegy, El Paso, Williams) invested heavily in building commodity trading 
and risk intermediation businesses. The most notable player was Enron, which had more than 
1,000 energy traders and (even after post-scandal income restatements) more than $2 billion 
of annual trading profits. At the time of Enron’s collapse, its Enron Online trading platform was 
regularly settling commodity transactions in excess of $4 billion per day. 


Following Enron’s bankruptcy in late 2001, the liquidity of energy commodity markets dried up. 
Several trading-oriented companies (Dynegy, El Paso, Reliant, and Mirant) suffered big 
losses, and some narrowly avoided bankruptcy. Credit concerns and the absence of liquidity 
essentially eliminated trading profits. Wanting to distance themselves from risk and 
derivatives, many of the remaining industrial participants shut down their trading floors. 


McKinsey&Company 


19 


But the retrenchment was short-lived because the fundamental need to reduce volatility and 
secure financing had not disappeared. Major investment banks quickly stepped in, and after 
them hedge funds, hiring former employees of Enron and other energy players. By the end of 
2005, liquidity levels once again approached those of 2001. Many big investment banks 
acquired trading desks from industry players. Two such banks together reported more than $3 
billion in profits from energy commodity trading and risk management over just the 2 years 
2005 and 2006. 


Several innovative players took advantage of liquid commodity markets and turned 


aggressively to strategic risk management.!”7 Among them, the most dramatic example is 
TXU Corporation. 


Case study: TXU Corporation 


TXU was the incumbent electric utility in North Texas when the state fully deregulated 
wholesale and retail electricity markets in 2002. Competition, capacity overinvestment, and 
commodity price exposures triggered by deregulation put TXU under severe pressure, 
reducing its market capitalization by more than half between late 2002 and late 2003 and 
burdening the company with debt above 70 percent of its market capitalization. 


When John Wilder became CEO in February 2004, he realized that even a small decline in 
wholesale power prices would put the company at risk of bankruptcy. Wilder responded by 
initiating TXU’s highly successful risk-and-return restructuring program, which was built on two 
core principles: embracing risks of which TXU was the natural owner while actively mitigating 
all others, and dynamically managing TXU’s risk capacity to ensure continued solvency and 
liquidity. 


Wilder's primary Texas competitor abandoned its integrated retail and generation business in 
response to deregulation and experienced lackluster equity returns. Other deregulated 
generators moved to hedge their risks by entering highly discounted power purchase 
agreements (PPAs). But Wilder, against example and advice, determined that TXU was in 
fact the natural owner of its generation business, despite the apparent risks of a downturn in 
the wholesale market. Wilder recognized that wholesale power price levels were heavily 
influenced by TXU's own investment and pricing decisions. He also realized that TXU's 
vertically integrated retail business provided the company with a natural hedge: Should the 
wholesale market turn down, TXU could compensate by keeping its retail prices 
proportionately high so long as it could maintain a large portion of its market share through 


17 Flores & Rucks (later Ocean Energy and now merged into Devon Energy) grew from a start-up to 
become one of the most successful independent producers using structured financing vehicles such 
as loans secured on underlying oil and gas assets. Chesapeake Energy has grown into an industry 
leader in exploration and production on a business model built around fully hedging its natural gas 
exposure. Refiners such as Valero, Tosco, and Premcor have used hedging and risk strategies to 
fund dramatic acquisition- and merger-based growth. Suncor, a pioneer in extracting oil from 
Canadian oil sands, has in the past used hedging to maintain its capital-intensive program through 
industry down cycles. Anadarko used creative bridge financing and hedging to enable two largely 
debt-funded simultaneous acquisitions whose total cost exceeded Anadarko's own market 
capitalization. 
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strong marketing and customer service. (In this sense, TXU’s exposure was a natural call 
option on higher prices, rather than a simple long position.) Taken together, he determined 
that generation and wholesale power, including the related risks, were worth more to TXU than 
to any other owner or hedge counterparty — that is, any other player would charge more to 
take on the risk than the value of any loss TXU might expect to incur by retaining it. 


Gain transparency into true economic exposures: 
TXU example 


ERCOT dispatch curve Equivalent Impact of a 
$/MWh North $1/MMBtu change 
American gas in gas price on 
reserves equity value 
TCF % 


TXU 
AEP 


Exelon 


Exxon 
BP 
Anadarko 


Chevron 


Conoco 
Shell 


But in committing to the generation business, TXU faced a formidable risk-capacity problem: it 
would need to fund the capital investment required to maintain its generation business while 
keeping an adequate cushion against a material chance of bankruptcy should power prices 
decline. Wilder’s response was to create additional risk capacity through a program of 
divestitures, capital-structure changes, outsourcing, and operational improvements. In his first 
60 days, he divested four businesses and used the $7 billion in proceeds to repurchase debt 
and convertible securities. He outsourced TXU’s call centers and billing operations, and he 
launched a major lean-operations improvement initiative in the company’s plants and mines. 


Wilder used some of this newly created risk capacity to restore TXU’s exposure to wholesale 
prices, unwinding expensive commodity hedges entered into by TXU’s prior management 
team. His market foresight paid off. Wholesale power prices more than doubled from early 
2004 to the end of 2005, yielding profits unmitigated by unnecessary hedging. Wilder used the 
remainder of his excess risk capacity to repurchase stock. Over the next year, he bought back 
almost 40 percent of TXU’s outstanding shares at an average price of $25 per share. When 
financial models indicated that the company was carrying excess risk capacity in late 2004, 
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TXU entered the bond market to borrow $4 billion for the express purpose of buying back even 
more shares. 


Over the following 2 years, TXU continued to optimize its risk capacity dynamically, actively 
managing commodity hedging, corporate debt, project finance, outsourcing, and share 
buybacks. For example, in late 2006, when TXU embarked on a major capital-expenditure 
program to build new coal-fired generation plants, it locked in favorable market terms by 
hedging the resulting increase in its exposure to natural gas and by making large-scale, fixed- 
price equipment purchase commitments so that it could project its costs with confidence. 
Even though plans for several of its new plants were cancelled following TXU's 2007 LBO, the 
company still profited from these commitments (e.g., it recorded almost $1 billion in hedging 
gains). The exhibit below shows how TXU dramatically reduced its risk exposure in 2004, 
before Wilder’s aggressive strategy allowed it to increase its risk-taking from a much sounder 
financial base. The distributions in the small charts show Monte Carlo simulations of TXU’s 
interest-coverage ratio, a key financial measure for industrial companies (note that this ratio 
shifted from minimal coverage to a much stronger position as TXU’s strategy developed). 


TXU example: dynamic management of risk capacity 


Return Share price 
Description Step Date ($) 


Project finance, new plants @,° Early 2007 65 


Gas price increases, growth program ® Mid-2005 52 


Debt issuance/share repurchase 
($4bn recap) Early 2005 38 


Operational improvement, share 
buybacks, hedge removal @ Aug-Sept 2004 24 
Operational improvements @ May 2004 


Divestitures ($7 bn) & April 2004 
security retirements New CEO arrives @ February 2004 


Risk 


Step 0: February to April 2004 Steps 1, 2: April to August 2004 Steps 3, 4: Late 2004/early 2005 


% of trials % of trials Improvement: 2.8x % of trials Coverage ratio 
60 03A decrease: 0.8x 


0 4 6 2 0 2 4 6 
EBIT/gross interest EBIT/gross interest EBIT/gross interest 


Wilder’s use of risk mechanisms and markets allowed TXU to focus its portfolio on risks of 
which it was the natural owner, and its financial returns grew rapidly. In 2006, TXU generated 
EBITDA of $5.3 billion (up by more than $2.5 billion from 2003, despite a 40 percent reduction 
in the company’s asset base) and earnings per share of $5.55 (up more than fourfold from 
2003). Its share price increased from $12 in early 2004 to $69 when it was taken private via 
leveraged buyout (LBO), creating more than $32 billion in value, and placing it fourth among 
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S&P 500 companies in terms of stock performance. TXU estimates that its risk-return 
restructuring program contributed some 75 percent of this value. 


In October 2007, TXU was taken private in the largest-ever LBO, a $45 billion deal led by 
KKR, TPG, and Goldman Sachs. Interestingly, the transaction economics hinged in part on the 
buyers’ ability to continue to manage TXU’s exposure to commodity price risk. After hedging 
virtually all the company’s commodity risk for the next few years, the private-equity owners 
tripled debt levels (from $12 billion to $37 billion). The largely annuitized operating cash flows 
(achieved by hedging the commodity risk) are expected to ensure debt coverage and allow the 
new owners to recover most of their $8 billion equity investment. The use of hedges and non- 
amortizing debt have effectively provided the new owners with a low-cost call option on 
wholesale power prices. In effect, via this clever structure, they own the upside while the debt 
holders bear most of the risk of a decline in value — although the latter, too, are protected in 
part by the commodity hedges. The buyers took aggressive advantage of an extremely LBO- 
friendly market, in which the combination of hedging and debt was thought to create a lower 
cost of capital than public equity. Time will tell how TXU’s new owners and their creditors 
adapt to the new risk environment. 


A practical corporate risk-management process 


Just as many risks faced by financial institutions have been well understood in the academic 
context for decades, so too has academia long possessed the management and decision- 
theory insights that nonfinancial companies must master.'8 But if the individual tools are well 
understood in academia, the challenge is applying them effectively to a company’s situation. 


The fullest approach to corporate risk management is known as enterprise risk management 
(ERM). Rather than seeing and tackling risks one by one, ERM aspires to view all risks 
“together within a coordinated and strategic framework.”!9 While sound in concept, many 
companies have found that their ERM processes have failed to deliver on their promise. As a 
result, many have become skeptical of the concept, and there is now a widespread sense that 


“today, ERM largely exists in name only."20 


We believe that ERM’s shortfalls stem from the lack of a practical approach that can be 
integrated with a corporation’s other core managerial processes. As such, our best service to 
our clients is to provide them with the background offered here, along with a straightforward 
five-step program that will allow them not merely to anticipate and respond to risk events but to 


18 Five of the most influential strands of this theory — scenario planning, game theory, decision trees, 
real option value, and behavioral heuristics — are described in “A Primer on Tools and Techniques of 
Risk Management” (ID# 737072). 

19 This definition comes from Brian W. Nocco and René M. Stulz, “Enterprise Risk Management: 
Theory and Practice,” Journal of Applied Corporate Finance, vol. 18, no. 4, pp. 8-20. 

20 Quoted from Michael Crouhy, Dan Galai, and Robert Mark, The Essentials of Risk Management, 
New York: McGraw-Hill, 2006, p. 387. 
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use risk as a Strategic and operational organizing principle. The five steps, also illustrated in 
Exhibit 6, are as follows: 


1. Develop risk transparency. What are the corporation's major risks, and what is the 
magnitude of those risks? 


2. Determine whether you are the natural owner of the risks you are running. Which 
risks should the corporation hold, and which should it mitigate or transfer? 


3. Determine your capacity and appetite for risk. Is the corporation maintaining the 
proper amount of risk capital, or is it overinsured or underinsured? How much risk would it 
like to own? 


4. Embed risk awareness in all decisions and processes. Are risk-return trade-offs fully 
embedded in the company’s strategic, operational, commercial, and financial decision- 
making processes? 


5. Establish a risk-appropriate culture, organization, and governance model. Is there 
proper risk oversight at all levels of the organization? 


Exhibit 6 


An integrated approach to managing risk and return 


1. Insight and risk transparency 
Do you have transparency across the 
range of risks that will affect your 
5. Risk organization and company's future performance, and deep 
governance insight into the risks that matter the most? 


Are the structures, systems, C i 
controls and infrastructure in orporate : 

í risk diagnostic (CRD) 2. Natural ownership and 
place for you to manage risk g risk strategy 


and comply with TEM Do you understand which risks 
dE ri 2E robusta your company is competitively 
g à advantaged to own and which you 


Risk governance and Integrated should Seek to transfer or mitigate 
organization realignment Skrat in order to meet your strategic 
risk-return corporate objectives? 
management 
Natural 
ownership of risk review 


4. Risk-related decisions and 
managerial processes (IRRM) 
Are critical business decisions taken 
with a clear view of how they change Risk cultur 
your company’s risk profile ? NEL. i / iit 
. Risk capacity and appetite 


EET E Is your overall risk capacity aligned 
Core service lines in investment/ with your strategy? Do you have 


project risk, financial risk, operational processes to ensure that you avoid 
risk, regulatory risk, being overextended or over- 


and commercial risk (including insured? 
hedging/trading, credit contract 


negotiation, pricing, and sourcing) pis Mai capital 
structure review 


These steps make most sense at the enterprise level, although they can be applied to 
business units within a company. Sound implementation of the full program will strengthen a 
company's risk-return situation. And each step can form the basis for a conversation with the 
CEO. 
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1. Developing risk transparency 


It is easy to grasp that an uncertain future is better expressed by a probability distribution than 
by a single-point forecast. In practice, however, single-point forecasting is still the norm. Best- 
practice risk assessment requires adopting a probabilistic view of a company’s key risks. In 
some cases, the probabilities can be ascertained from traded markets (e.g., by deriving 
implied volatility from options traded on commodity futures markets). In other cases, they can 
be extrapolated from an analysis of historical data. For example, companies can compile data 
from past projects and model the statistical likelihood of the success of future projects. Of 
course, in many situations, risk probabilities are more difficult to quantify and require more 
subjective assessments. Fortunately, an array of decision tools can help, including scenarios, 


agent-based modeling, and Delphi surveys.?1 


In our experience, just a few types of risk typically drive the exposure of a given company. 
Contrary to the exhaustive list that many ERM processes churn out, we advocate a strategic 
conversation on the several types that matter — typically, demand, commodity, country, 
operational, and foreign-exchange risk. The list will vary slightly by company, industry, and 
geography. In one example, we advised a diversified metals company which had identified 
sixty risks across its business units. We found that six of these risks contributed more than 90 
percent of the overall cash-flow volatility. 


Once individual risk assessments have been made, companies can use a number of 
approaches developed by leading financial institutions, including Monte Carlo simulations, 
which aggregate risk at the enterprise level, or value-at-risk measures, which enable the 
company to estimate the maximum downside it is likely to face and to value the impact of 
various risk-mitigation actions. 


A dynamic perspective is crucial. If the industry evolves unfavorably, will it be possible to pass 
risks on? In the 1990s, U.S. airlines faced relatively limited fuel-cost risk since fuel-price 
changes could be passed on in fares. But beginning around 2002, low-cost carriers such as 
Southwest Airlines began to hedge their fuel purchases and offer fares that no longer floated 
with the oil markets. Major carriers could no longer raise their fares when oil prices increased 
and suffered billions of dollars in losses from their “new” exposures. Similarly, in the aluminum 
industry, the arrival of Chinese producers meant that rising labor costs in developed 
economies could no longer be passed on to customers. 


A second aspect of risk assessment identifies "portfolio effects" within the company: risks that 
are effectively diversified away within the company itself. Common examples are foreign- 


21 One other tool that is becoming increasingly popular is offered by so-called information or prediction 
markets. Essentially, these have been adapted from futures markets originally designed to predict 
the outcome of elections. "Voters" can use an organized exchange to place bets on which 
candidates they think are most likely to win. These have proved to be far more accurate than 
opinion polls. In corporate settings, such markets have already found some interesting applications. 
One leading U.S. retailer found that the accuracy of its sales forecasts was substantially greater 
using a prediction market that tapped the direct knowledge of its regional sales teams rather than 
relying on a centrally generated forecast. Google has been a pioneer in this area, creating markets 
on dozens of occasions to test ideas and monitor project performance. For more on this, see Bo 
Cowgill, Justin Wolfers, and Eric Zitzewitz, "Using Prediction Markets to Track Information Flows: 
Evidence from Google,” at http://bocowgill.com/Google PredictionMarketPaper.pdf. 
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exchange netting across a multinational or vertical integration across markets for inefficient 
factor costs. 


Finally, a diagnosis must address the big “what ifs” facing the company. As Myron Scholes 
pointed out, it is helpful to divide risks into three categories: those that are known, those that 
are unknown, and those that are unknowable (the “KUU” framework). This ensures that 
outlying risks that could have a meaningful impact on future performance are identified. 


There are challenges to a risk diagnosis that go beyond its technical aspects. Internal 
dynamics can interfere: business unit heads may push to secure funding for certain projects, 
whether or not the company has better options elsewhere, or problems of definition could arise 
(e.g., the legal and financial departments might have different views of risk and no shared 
language or measures with which to discuss them). So implementation is not straightforward. 
Nevertheless, the process itself is an essential and eye-opening foundation for risk- 
management decisions. 


2. Are you the natural owner? Holding, acquiring, 
mitigating, and divesting risk 


In the 1970s, a revolution occurred in the field of corporate strategy. A boom in mergers and 
acquisitions launched new professions in M&A banking, M&A law, and strategy consulting. 
Given an active and efficient market for corporate control, companies shifted their corporate 
strategy focus from owning the most attractive businesses to owning those businesses for 
which they were competitively advantaged — of which, that is, they were the natural owners. If 
an owner were not advantaged, then even its fastest-growing or most profitable businesses 
could be divested at prices above the company’s “hold case.” Conversely, if the company 
were a competitively advantaged owner, it was typically sensible to keep even its least exciting 
businesses. 


A similar revolution is now occurring in the field of strategic risk management. Once again, the 
catalysts are emerging marketplaces: risk-transfer markets such as those for financial 
derivatives, commodity derivatives, business process outsourcing, reinsurance and contingent 
capital, and so on. Companies can now seek out not only businesses for which they are the 
natural owner (which represent a bundle of risks), but also those risks for which they would be 
the natural owner. Such risks should be kept and, if possible, acquired. All others should be 
hedged or transferred. 


How does a management team assess natural ownership? We have found three questions 
helpful. First, does the corporation’s business portfolio contain natural offsets? Second, does 
the company have differentiated capabilities to manage the risk (e.g., information advantages 
in traded commodities, project-management skills for large investments)? Third, are the 
accessible risk-transfer markets reasonably efficient (e.g., the market for interest-rate 
derivatives is so efficient that even the most sophisticated banks derive no benefit from natural 
ownership)? 
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Exhibit 7 
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The natural-ownership assessment yields a clear risk strategy for the company (Exhibit 7 
above illustrates this assessment using the airline industry as an example). Advantaged risks 
create superior returns and (subject to the risk-capacity issues addressed below) should not 
be hedged or transferred. In fact, the company should seek to acquire such risks, whether in 
risk-transfer markets or embedded with assets or commodities in physical markets. 
Disadvantaged risks should be mitigated wherever there are efficient risk-transfer markets. 
Even when such markets are not available, it may be possible for companies to develop risk- 
transfer opportunities (e.g., long-term contracts or tolling arrangements with customers or 
suppliers, joint ventures with partners that have offsetting risk positions). 


In a well-known case that illustrates the concept of natural ownership, Southwest Airlines 
persevered through the industry-wide downturn in the airline business following September 11, 
2001, maintaining three decades of profitable performance. A contributing factor was a 
sophisticated fuel hedging strategy begun in the 1990s, which allowed Southwest to reduce its 
fuel costs by as much as 50 percent compared with competitors. The strategy has generated 
gains in excess of $4 billion. In 2005 alone, hedging gains represented $1 billion (105 
percent) of Southwest’s operating income. Less well known, however, is the reasoning behind 
Southwest’s hedging decision. For its executives, thinking about fuel-cost risk was only part of 
a larger strategy centered on the principle of stability of costs, service levels, and fares. They 
knew that rising fuel prices were the biggest threat to the company’s business model as a low- 
cost carrier. The decision to lock in those prices was not a decision to place a bet on oil 
markets. Rather, the executives reasoned that whatever happened, Southwest needed to 
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remain a low-cost provider. If fuel prices rose, the hedge meant they would win in the market 
because existing labor and productivity advantages would be further strengthened by an edge 
in fuel prices. If prices fell or stayed flat, Southwest would still be the low-cost leader, because 
its cost advantage in nonfuel areas was greater than any reasonable expectation of a fall in 
fuel prices. 


3. Determining risk capacity and appetite 


Once a company has identified the risks it should own and sought to mitigate all others, it 
should reexamine its risk capacity and potentially acquire more advantaged risks. 


To understand whether it has the optimal level of risk capacity, a company must first quantify 
its operating-cash-flow risk. A Monte Carlo simulation to develop probability distributions of 
cash inflows over the next few years can be mapped against the company’s projected cash- 
flow needs to determine the probability of shortages or surpluses over time. 


Exhibit 8 illustrates how to apply this “cash flow at risk” concept. It maps a distribution of 
future operating cash flows against the company’s cash needs. If the distribution falls too far 
to the right, there is a negligible chance of an outcome that does not easily meet anticipated 
needs, and the company is being unduly conservative. Too far to the left (as in Exhibit 8), and 
the company would be underinsured against events that could limit its ability to meet even 


Exhibit 8 
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basic cash needs. This explains the second element of the chart: the idea that a dollar of cash 
flow does not always have the same value. Used to pay interest and principal, a cash-flow 
dollar is worth far more to shareholders than a dollar used for more discretionary purposes. In 
effect, the chart illustrates what is only a relatively recent ability to use quantitative methods to 
help a company think strategically about its risk-bearing capacity. 


Exhibit 9 extends this idea by showing examples of two companies, both of which need to 
adjust their risk capacity so that the cash-flow distribution appropriately aligns with their 
strategic goals. 


In addition to optimizing risk capacity against annual cash-flow requirements, many companies 
should manage their risk capacity against other dimensions of enterprise risk. A company ina 
cyclical industry might want to manage its overall equity value at risk, seeking to keep its 
expected stock-price volatility below an absolute level or below the expected level of a peer 
group. Alternatively, a company might place a high premium on meeting earnings-per-share 
guidance and thus want to assess and manage earnings at risk. 


Exhibit 9 


Risk capacity can be optimized to avoid inefficient risk-return management 
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Exhibit 10 on the following page provides a simplified comparison of debt and risk levels in 
different industries and suggests that there is a huge scope for companies to rebalance their 
capital structures in light of their risk capacity. 
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Exhibit 10 
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Source: Bloomberg; Datastream; McKinsey analysis 


Of course, none of these tools can absolutely ensure that a company won't suffer a shortfall. 
Extreme and unanticipated outcomes do occur. A sophisticated risk-management system, 
however, can often identify and rectify a strategic course that is taking a company toward the 
overextended or overinsured extremes that we find to be all too common. 


4. Embedding risk awareness in decision-making and 
managerial processes 


Risk management is not an exercise to be undertaken once, or once a year. It is an attitude to 
problems and decisions. Psychology and behavioral economics have established that we have 
difficulty correctly incorporating risk into our thinking. So companies must put in place formal 
processes for risk-informed decision making. 


In some respects, this is more challenging than the earlier elements of the risk-management 
process this paper has outlined. It requires commitment, discipline, and senior leadership 
willing and able to communicate why risk is a critical metric for decisions. It also inevitably 
requires a willingness to apply risk thinking in new areas. 


For this to happen, there must be a broad understanding of the range of decisions to which 
risk management is relevant. Four kinds of managerial decisions can benefit substantially 
from risk-enabled approaches: 
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m Investment decisions. By adopting a probabilistic approach to investments, companies 
can avoid many of the pitfalls inherent in more traditional evaluations. Instead of a single 
NPV point estimate, companies can determine the probability of a whole range of 
outcomes, including the probability of a negative NPV. The range of probabilities can then 
be compared with those under alternative project structures — e.g., turnkey engineering, 
procurement, and construction (EPC) contracts or hedged product prices. Companies can 
also quantify the value associated with real options — the ability to defer or accelerate an 
investment program based on unfolding events. 


= Commercial decisions. Most industrial purchasing and pricing decisions, whether short- 
term spot or long-term contracts, can benefit from “risk-book” concepts common to 
financial asset management and trading firms. Risk books break complex risks into 
component parts, enabling more effective matching and measurement of exposures. For 
example, a chemical company that produces plastics for packaging could better 
understand its true exposure to oil prices, and whether higher costs for its feedstock will be 
more than offset by the higher prices resulting from higher costs for competing materials 
such as aluminum or paper. 


m Financial decisions. Most financial policy decisions involve risk trade-offs that should be 
viewed in the context of enterprise cash flow and value trade-offs. Should the company 
employ greater hedging to increase its debt capacity? Should the capital budget be cut to 
provide a cushion? Should the company issue equity instead of debt to fund an 
acquisition? Too often, these decisions are based on arbitrary debt/equity guidelines or 
target credit ratings instead of cash-flow-at-risk and value-at-risk principles. 


= Operational decisions. Decisions on a company’s manufacturing footprint, supply chain 
design, outsourcing, and inventory policy involve significant risk-return trade-offs that can 
also benefit from an enterprise risk perspective. 


Generally, these decisions are neither coordinated across a company nor evaluated using risk 
decision tools. Investment and operational decisions are made by business unit managers; 
procurement decisions by purchasing; pricing decisions by sales-force management; and 
financial policy decisions by the CFO. Yet each decision consumes or creates risk capacity. 
Each involves uncertainty and risk exposure. 


We cannot overstate the importance of this. Ask clients whether they struggle with big 
decisions such as whether to enter a new market, increase R&D spending, or whether to lower 
prices by squeezing their procurement processes. The typical approach is to take a base 
case, or perhaps a high and low case, and forecast accordingly. But these are to a large 
extent risk-management questions. Working off one case or even three ignores most of the 
probability distribution — ignores, that is, most of reality. 


Exhibit 11 illustrates how the tools we have discussed might help across different types of risk. 
Table 2 lays out the impact this approach can have in a range of industries. 
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Strengthening decision making using all available tools 
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Table 2 


Examples of risk across industries 


Industry 


Where risk management can lead to better decisions 


Pharmaceuticals 


How robust is our R&D pipeline? Which drugs should we license? 


Consumer goods 


Should we lock in volatile materials and packaging costs? Will we be 
able to pass through commodity price increases? 


Electric utilities 


How should we invest in view of the controversy over greenhouse gas 
emissions or with regard to regulations on renewable power? 


Telecom 


How and where should we invest to compete in VoIP? 


Software 


Do our global sales justify multilocal manufacturing? Can we manage 
currency risks more effectively with derivatives? 


Automotive 


Should we continue to grow our call center in India or look for a lower- 
cost site that will take longer to become operational? 


Railroads 


Should we hedge our fuel costs? Are we helped or hurt by higher oil 
prices given their competitive impact on truckers? 
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5. Establishing a risk-appropriate culture, organization, 
and governance model 


In an ideal world, all business managers or decision makers would analyze the impact of a 
proposed project or investment on the overall level of the company’s risk and make precise 
trade-offs that would help the company maintain optimal risk exposure. In the real world, this is 
true only in companies that have a strong risk culture that informs how managers at all levels 
make decisions. This includes incentive systems that encourage individuals to value the 
whole enterprise rather than personal fiefdoms and to make decisions with an eye to long-term 
economic outcomes rather than short-term performance. 


It is not easy to get managers thinking about risk in the way we have described. A highly 
motivated CEO who understands the power of managing both risk and returns can inspire an 
entire management team and shape corporate culture. But this requires a lot of education on 
the part of the CEO and the application of consistent discipline. It does not happen overnight, 
but rather takes years. Yet when it does occur, in our experience, it tends to have a lasting 
positive impact on how a company performs. One highly successful company that has very 
publicly put risk at the center of its culture is BHP Billiton, which has combined the 
sophisticated use of analytics to support its strategic decisions with unprecedented 
transparency about risk taking for stakeholders. 


No discussion of risk would be complete without acknowledging that the oversight of a risk- 
return management effort requires constant vigilance from a company’s executives and board. 
Companies with the best risk-management processes describe a culture of questioning and 
openness: information is simultaneously challenged and filtered in an organized fashion to 
minimize surprises. By contrast, in many companies there is no clear governance structure 
and the effort becomes segmented, just as risk is siloed and therefore not understood at the 
firm level. Exhibit 12 on the following page suggests some typical shortcomings — reminding 
us at the same time of the complexity of the organizational challenges that must be overcome 
to embed a risk-return-based culture. 


Because a strategy must be formulated in the context of the organization that will execute it, 
systematic or strategic risk management can happen only if the organization is aligned from 
top to bottom so that everybody has a common understanding of the company’s key risks and 
a Clear line of sight into the overall level of exposure to those risks. Few companies achieve 
this. Most may try to identify the different aspects of risk, and perhaps take some mitigating 
steps, but lack genuine insight into the risks they are running. Although companies may 
employ a chief risk officer, they are unlikely to imbue the role with much power and tend to 
have only limited understanding of how risks interact. Many of these companies will be using 


capital sub-optimally and will also be running strategic risks of which they are unaware.22 


22 Nocco and Stulz suggest two essential organizational components. First, all business managers (or 
decision makers) should be required to “evaluate project returns in relation to the marginal increases 
in firmwide risk to achieve the optimal amount of risk at the corporate level." Second, performance 
evaluations of business units should take into account their contributions to the total risk of the firm 
so that managers at every level have the incentive to refuse risks that are economically unattractive 
("Enterprise Risk Management: Theory and Practice," pp. 4-7, see note 19). 
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Exhibit 12 
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Even companies that have an appreciation of the risks they are taking, and some 
sophistication about managing them, usually fall short of what is required. The most common 
mistake is to adopt a decentralized approach, in which business units own risks with oversight 
from the corporate center, which has some degree of power over portfolio choices that 
aggregate risks in positive ways. This is typical of large, project-based companies with 
complex risks of long duration. Such companies tend to have only limited understanding of the 
real risk-reward trade-offs at the aggregate level and usually combine large equity cushions 
with heavy insurance to protect downside exposure. There is often tension between the center 
and the business units — the latter tends to perceive the risk function as internal “police,” 
determined to call a halt to independent activity. 


In our experience with clients, we have found that the most effective model by far is a 
centralized one, with a powerful chief risk officer who reports to the chief executive and 
presents regularly at the board level. Companies with this structure tend to manage volatile 
risks that require vigilance and discipline. Risk is embraced for its upside potential because 
the corporate culture understands it and is in command of the trade-offs being made. As we 
have noted, successful risk-return managers such as Goldman Sachs ensure that the 
organizational functions responsible for risk are widespread. They also make sure that 
successful managers who rise through the organization spend some time working in the formal 
risk-return function, so that this experience will shape how they interact with the function from 
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subsequent positions as senior decision makers either in the corporate center or in business 
units. A risk-return philosophy becomes an integral part of the cultural norms of the 
organization. 


The message is clear: companies must consider both the risks and returns of their strategies. 
The considerations are best done systematically. Those companies with good risk-return 
management systems and a culture of careful decision making will outperform less disciplined 
competitors. Top management, including the CEO and the board, should take the lead in 
introducing a dynamic risk-return management process. Strategically, this means 
understanding the risks being taken, determining which risks the company should own, and 
assessing whether the company’s risk capacity is properly aligned with its strategy. 
Operationally, this means avoiding any tendency to rely on gut feeling and introducing and 
championing analytics and decision-support tools. For us as consultants, bringing the 
surgeon’s tools offered by financial risk management, even at a time when many financial 
institutions appear to have lost some of their own discipline, together with the blunter but very 
practical tools of corporate leadership, can allow us to achieve a significant positive impact in 
helping companies through the evolution — or the revolution — required to improve their 
performance over the long term. 


Kevin Buehler is a Director in the New York office. Andrew Freeman is a Risk Practice 
senior knowledge expert based in the London office, and Ron Hulme is a Director in the 
Houston office. 
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management. This source list is intended as a guide to some of the most useful texts and is 
not meant to be comprehensive. It complements, rather than reproduces, the texts mentioned 
in the footnotes. 
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